Lock tool sessions to their model

docs/USER_GUIDE.md

@@ -196,6 +196,13 @@ stored per model; the custom system prompt is shared across profiles. Other
 sections control A2UI, permission defaults, endpoint settings, Git diff display,
 Dev Brain, extensions, checkpoint storage, and diagnostics.
 
+A session remains model-independent until its first tool call. That call locks
+the session to its model so persisted tool syntax is never mixed. Continuing a
+locked session while another model is active asks before switching back. Legacy
+sessions recover the exact model from their checkpoint when available; a legacy
+tool session whose exact model can no longer be identified remains viewable but
+cannot be continued.
+
 ### Main views, sidebar, and branches
 
 **Chat** shows the conversation, **A2UI** shows interactive surfaces, **Git**